Network device identification via similarity of operation and auto-labeling

Abstract

Systems and methods include receiving data associated with monitoring network communication traffic associated with a plurality of network devices; analyzing network communication flows of the plurality of network devices to group similar network devices together; analyzing patterns, frequency, relevance, and origination of words in the network communication traffic to auto-label the plurality of network devices; and assigning one or more words to any of a given network device and a group of similar network devices.

What is claimed is: 
     
       1. A non-transitory computer-readable medium comprising instructions that, when executed, cause one or more processors to perform steps of:
 receiving data associated with monitoring network communication traffic associated with a plurality of network devices; 
 analyzing, via a machine learning model, network communication flows of the plurality of network devices to group network devices together based on a similarity measurement shared by the network devices; 
 analyzing, via the machine learning model, patterns, frequency, relevance, and origination of words in the network communication traffic to auto-label the plurality of network devices; 
 assigning one or more words to any of a given network device and a group of network devices; 
 providing a display in a graphical user interface of any of the given network device and the group of network devices with the corresponding one or more words thereby providing meaningful human understandable words; and 
 utilizing the corresponding one or more words for assigning security policies to the any of the given network device and the group of network devices. 
 
     
     
       2. The non-transitory computer-readable medium of  claim 1 , wherein the monitoring is via a cloud-based system having a plurality of nodes, and wherein the one or more processors are in one of the plurality of nodes. 
     
     
       3. The non-transitory computer-readable medium of  claim 1 , wherein the words include any of vendor names, brand names, product names, and model numbers. 
     
     
       4. The non-transitory computer-readable medium of  claim 1 , wherein the analyzing of the patterns, frequency, and origination of words is performed on network communication traffic associated with a group of devices such that words are scored based thereon. 
     
     
       5. The non-transitory computer-readable medium of  claim 1 , wherein the assigning is based on a score for a given word that is determined based on weights for the patterns, frequency, relevance, and the origination. 
     
     
       6. The non-transitory computer-readable medium of  claim 5 , wherein the patterns include words used together indicative of a network device. 
     
     
       7. The non-transitory computer-readable medium of  claim 5 , wherein the frequency utilizes term frequency-inverse document frequency (TF-IDF). 
     
     
       8. The non-transitory computer-readable medium of  claim 5 , wherein the relevance is based upon presence in one or more database of relevant words. 
     
     
       9. The non-transitory computer-readable medium of  claim 5 , wherein the origination is based on where the words are from including any of user input, an agent, and network addresses including any of Internet Protocol (IP), Media Access Control (MAC), Domain Name System (DNS), Uniform Resource Locator (URL), a hostname, and a web host. 
     
     
       10. The non-transitory computer-readable medium of  claim 5 , wherein the weights include higher weighting where a word is used for a particular group of devices at a higher frequency than for other groups of devices. 
     
     
       11. The non-transitory computer-readable medium of  claim 5 , wherein the weights include higher weighting where a word is from user input or an agent. 
     
     
       12. A method comprising steps of:
 receiving data associated with monitoring network communication traffic associated with a plurality of network devices; 
 analyzing, via a machine learning model, network communication flows of the plurality of network devices to group network devices together based on a similarity measurement shared by the network devices; 
 analyzing, via the machine learning model, patterns, frequency, relevance, and origination of words in the network communication traffic to auto-label the plurality of network devices; 
 assigning one or more words to any of a given network device and a group of network devices; 
 providing a display in a graphical user interface of any of the given network device and the group of network devices with the corresponding one or more words thereby providing meaningful human understandable words; and 
 utilizing the corresponding one or more words for assigning security policies to the any of the given network device and the group of network devices. 
 
     
     
       13. The method of  claim 12 , wherein the monitoring is via a cloud-based system having a plurality of nodes. 
     
     
       14. The method of  claim 12 , wherein the words include any of vendor names, brand names, product names, and model numbers. 
     
     
       15. The method of  claim 12 , wherein the assigning is based on a score for a given word that is determined based on weights for the patterns, frequency, and the origination. 
     
     
       16. The method of  claim 15 , wherein the patterns include words used together indicative of a network device. 
     
     
       17. The method of  claim 15 , wherein the frequency utilizes term frequency-inverse document frequency (TF-IDF). 
     
     
       18. The method of  claim 15 , wherein the origination is based on where the words are from including any of user input, an agent, and network addresses including any of Internet Protocol (IP), Media Access Control (MAC), Domain Name System (DNS), Uniform Resource Locator (URL), a hostname, and a web host. 
     
     
       19. The method of  claim 15 , wherein the weights include higher weighting where a word is used for a particular group of devices at a higher frequency than for other groups of devices. 
     
     
       20. The non-transitory computer-readable medium of  claim 1 , wherein the steps further comprise:
 training the machine learning model to perform grouping and auto-labeling of network devices.